Whenever I run the log show
command from the command line, I get a warning message, log: warning: The log archive contains partial or missing metadata
.
This appears to prevent me from using the --last
option to limit output to the most recent time interval. The failed log
command returns an exit status of 65.
% log show --last 2s --style syslog
log: warning: The log archive contains partial or missing metadata
log: cannot use --last when archive metadata is missing
% echo $?
65
What I want to happen is something similar to what I get when I use the --start
option with a timestamp in the recent past. The successful command returns an exit status of 0.
% date
Fri 10 Jan 2020 18:43:56 PST
% log show --start "2020-01-10 18:44:00" --style syslog
log: warning: The log archive contains partial or missing metadata
Skipping info and debug messages, pass --info and/or --debug to include.
Timestamp (process)[PID]
2020-01-10 18:44:04.459968-0800 localhost xpcproxy[99272]: (libsystem_info.dylib) Created Activity ID: 0x1f9010, Description: Retrieve User by ID
2020-01-10 18:44:04.460147-0800 localhost xpcproxy[99273]: (libsystem_info.dylib) Created Activity ID: 0x1f9020, Description: Retrieve User by ID
…[snip, remaining output elided]…
% echo $?
0
How can I get the log archive to contain sufficient metadata so that log show --last 2s
works as I want it to?
This is observed on macOS High Sierra 10.13.6. My account has administrator access, which the log
command requires to return any content. The access is demonstrated by the log --start
command succeeding.
Best Answer
I have a very unsatisfying answer to this question: wait 10 days and hope the problem goes away by itself.
That approach just worked for me:
Note that the message,
log: warning: The log archive contains partial or missing metadata
no longer appears, and the--last
option now works.While investigating, I came across the very useful essay, Inside the macOS log: logd and the files that it manages, by Howard Oakley. This pointed me to the directories
/var/db/diagnostics/
and/var/db/uuidtext/
.I observe that subdirectories
/var/db/diagnostics/Persist/
and/var/db/diagnostics/Special/
contain opaque.tracev3
data files:Oakley says that the macOS log system rotates these files: gradually prunes out old and unnecessary content, then deletes old files altogether. The date stamps back him up. Note that the oldest
tracev3
file inSpecial/
is only 10 days old. Older files existed in this directory when I originally had the problem, but are now gone.It is interesting that many (but not all) of these files contain an extended file attribute "com.apple.logd.metadata". Oakley, in xattr: com.apple.logd.metadata, log metadata, says "their content and function are unknown". I speculate that the "metadata" term in the error message might be a reference to the data in the "com.apple.logd.metadata" xattr.
So, a wild guess is that a file in
/var/db/diagnostics/Special/
had a corrupted or missing xattr "com.apple.logd.metadata". In the course of a week, this file became old enough and was discarded. Once that file was discarded, its metadata was gone, and the so was the problem.